PRIVACY IMPACT ASSESSMENT ========================= Privacy impact assessment: A Make.com scenario sends the coordinator's draft assessment to Anthropic's Claude for a prose review and returns cited findings to the browser. Jurisdiction: British Columbia PIA basis: Required by the Act Aggregate status: Not ready 1. TOOL AND PROGRAM ------------------- Public body: Fipp itself (self-assessment; a demo product, not a public body) Program: AI review demo lane on the dossier stage Origin: Vendor-supplied What the tool does: A Make.com scenario sends the coordinator's draft assessment to Anthropic's Claude for a prose review and returns cited findings to the browser. Personal information: free-text program and data-flow descriptions; mitigation owner names (staff); public body and program names Sensitive information: No Personal health information: No People affected: coordinators using Fipp; employees named as mitigation owners 2. DATA FLOW ------------ Hop 1: Coordinator's browser -> Make.com webhook (us2 region) [United States] Residency: Outside Canada Hop 2: Make.com scenario -> Anthropic API (Claude) [United States] Residency: Outside Canada Hop 3: Make.com webhook response -> Coordinator's browser [Canada] Narrative: - Coordinator's browser sends the full draft assessment, free-text answers and mitigation owner names included to Make.com webhook (us2 region) (United States) to deliver the draft to the review pipeline. Stored at Make execution logs, retained up to 30 days. - Make.com scenario sends the same draft embedded in a model prompt, plus the statute pack to Anthropic API (Claude) (United States) to generate review findings. Stored at transient API processing. - Make.com webhook response sends the model's summary and findings to Coordinator's browser (Canada) to display the second opinion. Stored at browser memory only; findings are never persisted. Residency posture: Storage outside Canada is permitted in BC; there is no residency or consent rule. The gate is a s. 33 disclosure authority plus, when sensitive information is stored outside Canada, a mandatory supplementary assessment inside the s. 69 PIA under B.C. Reg. 294/2021. 3. STATUTORY CHECKLIST ---------------------- [Meets] Is each collection of personal information authorized, and is it collected directly from the person it is about, or under a listed exception? Citation: FIPPA ss. 26, 27 [Gap, mitigated] Are people told, at or before collection, the purpose of the collection, the legal authority for it, and who at the public body can answer questions? Citation: FIPPA s. 27(2) Remedy: Add a collection notice at every intake point stating the purpose, the authority, and a contact. Mitigation: Expand the demo-lane confirm dialog into a full collection notice naming the purpose, the authority, and a contact. (Owner: Kash Bains; due 2026-09-30) [Gap, mitigated] Are there reasonable security arrangements protecting the personal information the tool touches? Citation: FIPPA s. 30 Remedy: Document the administrative, technical and physical safeguards for the tool and fix any that are missing. Mitigation: Add API-key authentication to the Make webhook and confirm Make execution-log retention settings before any non-demo use. (Owner: Kash Bains; due 2026-09-30) [Gap] Do staff know they must report an unauthorized disclosure of personal information inside the public body? Citation: FIPPA s. 30.5(2) Remedy: Tell staff, in the tool’s operating procedure, who to report an unauthorized disclosure to and how. [Gap, mitigated] Is there a process to notify affected people and the commissioner if a privacy breach could cause significant harm? Citation: B.C. Reg. 155/2012, ss. 11.1, 11.2 Remedy: Write a breach response plan naming who notifies affected people and the commissioner, and on what timeline. Mitigation: Write a one-page breach response plan covering Make and Anthropic incidents. (Owner: Kash Bains; due 2026-10-15) [Meets] Is every use the tool makes of personal information a use FIPPA allows? Citation: FIPPA s. 32 [Meets] Can you point to the provision that authorizes each disclosure of personal information, including any disclosure to a vendor? Citation: FIPPA s. 33 [Meets] Where information is used or disclosed for a purpose other than the original one, is the new purpose consistent with the original? Citation: FIPPA s. 34 [Gap] Does the vendor contract make clear that the vendor’s employees are bound by the Act’s privacy rules? Citation: FIPPA s. 25.1 Remedy: Add privacy terms to the service agreement covering the vendor’s employees and subcontractors. [Meets] Data in this flow is stored or processed outside Canada. Is that disclosure in line with the ministerial regulations? Citation: FIPPA s. 33.1 [Meets] Have you assessed whether the personal information is sensitive? The Act does not define sensitive; the judgment is contextual. Citation: B.C. Reg. 294/2021, s. 2 [Meets] Is a privacy impact assessment being conducted for this tool under the applicable ministerial direction? Citation: FIPPA s. 69(5), (5.3); Directions 1-21 and 2-21 [Gap] Does the public body’s privacy management program cover its PIA process and its service providers’ privacy obligations? Citation: FIPPA s. 36.2; Direction 02/2022 Remedy: Update the privacy management program so it names the PIA process and how vendors are told their privacy obligations. 4. AUTOMATED DECISIONS ---------------------- No automated decisions recorded. 5. MITIGATION REGISTER ---------------------- - Are people told, at or before collection, the purpose of the collection, the legal authority for it, and who at the public body can answer questions? Expand the demo-lane confirm dialog into a full collection notice naming the purpose, the authority, and a contact. (Owner: Kash Bains; due 2026-09-30) - Are there reasonable security arrangements protecting the personal information the tool touches? Add API-key authentication to the Make webhook and confirm Make execution-log retention settings before any non-demo use. (Owner: Kash Bains; due 2026-09-30) - Is there a process to notify affected people and the commissioner if a privacy breach could cause significant harm? Write a one-page breach response plan covering Make and Anthropic incidents. (Owner: Kash Bains; due 2026-10-15) 6. MARMOT NOTES --------------- - Personal information leaves Canada: Make.com webhook (us2 region) runs in United States. (FIPPA s. 33.1) - Personal information leaves Canada: Anthropic API (Claude) runs in United States. (FIPPA s. 33.1) 7. CITATIONS IN THIS DOSSIER ---------------------------- - Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165 - Freedom of Information and Protection of Privacy Regulation, B.C. Reg. 155/2012 - Personal Information Disclosure for Storage Outside of Canada Regulation, B.C. Reg. 294/2021 Provisions cited: - FIPPA ss. 26, 27 - FIPPA s. 27(2) - FIPPA s. 30 - FIPPA s. 30.5(2) - B.C. Reg. 155/2012, ss. 11.1, 11.2 - FIPPA s. 32 - FIPPA s. 33 - FIPPA s. 34 - FIPPA s. 25.1 - FIPPA s. 33.1 - B.C. Reg. 294/2021, s. 2 - FIPPA s. 69(5), (5.3); Directions 1-21 and 2-21 - FIPPA s. 36.2; Direction 02/2022 8. SIGN-OFF ----------- Privacy officer: ______________________________ Date: ______________ Program lead: ______________________________ Date: ______________ ---------------------------------------------------------------------- AX-CLEARANCE/1 · fipp · pia-dossier · fipp/0.1.0 Checked at: 2026-09-04T23:11:16.507Z Dossier SHA-256: 0575d4a51aa0d8144fd854fb345a0bc5e465c3bef09b8331d6ed8a7b9c8351a0 Certificate SHA-256: 83b527730b02395b3ff492721033b10647e13f350a05a7bf1df5f0b0aad246b1 Display id: 83b5 2773 0b02 To verify this seal, run the same assessment through the same check. The dossier hash must reproduce exactly; the certificate hash seals it together with the result counts and the checked-at time above. The seal is a record of a mechanical check, not an opinion on the law. Reviewed by: ______________________________ Date: ______________ ----------------------------------------------------------------------